summaryrefslogtreecommitdiffstats
path: root/install/share
Commit message (Collapse)AuthorAgeFilesLines
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-02-232-0/+15
| | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542
* Remove non-sensical kdestroy on https stopSimo Sorce2017-02-221-1/+1
| | | | | | | | | | | | | | This kdestroy runs as root and wipes root's own ccachs ... this is totally inappropriate. Use a file ccache that ends up in the private tmp, so that if the service is restarted the file is automatically removed. https://fedorahosted.org/freeipa/ticket/6673 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add a new user to run the framework codeSimo Sorce2017-02-152-2/+10
| | | | | | | | | | | | | | | | | Add the apache user the ipawebui group. Make the ccaches directory owned by the ipawebui group and make mod_auth_gssapi write the ccache files as r/w by the apache user and the ipawebui group. Fix tmpfiles creation ownership and permissions to allow the user to access ccaches files. The webui framework now works as a separate user than apache, so the certs used to access the dogtag instance need to be usable by this new user as well. Both apache and the webui user are in the ipawebui group, so use that. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Configure HTTPD to work via Gss-ProxySimo Sorce2017-02-153-1/+10
| | | | | | | | https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use Anonymous user to obtain FAST armor ccacheSimo Sorce2017-02-152-0/+11
| | | | | | | | | | | | The anonymous user allows the framework to obtain an armor ccache without relying on usable credentials, either via a keytab or a pkinit and public certificates. This will be needed once the HTTP keytab is moved away for privilege separation. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Generate tmpfiles config at install timeSimo Sorce2017-02-152-0/+3
| | | | | | | | | | | | | | We do not want to generate runtime directories just because the packages are installed, but only if the server is actually setup and run. Also this will be needed later because we will create a user at install time and some tmpfiles will need to be owned by this user. As we are changing this code also rationalize the directory structure and move it from the http rundir to the ipa specific rundir. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change session handlingSimo Sorce2017-02-153-1/+4
| | | | | | | | | | | | | | | | Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* named.conf template: update API for bind 9.11Tomas Krizek2017-02-091-9/+7
| | | | | | | | | | | | | Use the new API for bind 9.11. Removed deprecated "serial_autoincrement" and updated the rest of configuration to conform to the new format. This only fixes new IPA installations. For existing installations, named.conf will be transformed when the new version of bind-dyndb-ldap is installed. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Martin Basti <mbasti@redhat.com>
* csrgen: Use data_sources option to define which fields are renderedBen Lipton2017-01-3112-64/+48
| | | | | | | | | | | | | | | This removes the ipa.syntaxrule and ipa.datarule macros in favor of simple 'if' statements based on the data referenced in the rules. The 'if' statement for a syntax rule is generated based on the data rules it contains. The Subject DN should not be generated unless all data rules are in place, so the ability to override the logical operator that combines data_sources (from 'or' to 'and') is added. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Add a CSR generation profile for user certificatesBen Lipton2017-01-314-0/+41
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Add CSR generation profile for caIPAserviceCertBen Lipton2017-01-316-0/+73
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Add code to generate scripts that generate CSRsBen Lipton2017-01-316-0/+148
| | | | | | | | | | | | Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dsinstance: extract function for writing certmap.confFraser Tweedale2017-01-111-1/+1
| | | | | | | | | | | | | | | | For full customisability of the IPA CA subject DN, we will need the ability to update DS `certmap.conf' when upgrading a deployment from CA-less to CA-ful. Extract the existing behaviour, which is private to DsInstance, to the `write_certmap_conf' top-level function. Also update `certmap.conf.template' for substition of the whole CA subject DN (not just the subject base). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* adtrust: remove FILE: prefix from 'dedicated keytab file' in smb.confAlexander Bokovoy2016-12-121-1/+1
| | | | | | | | | | | | | | | | | | Samba 4.5 does not allow to specify access mode for the keytab (FILE: or WRFILE:) from external sources. Thus, change the defaults to a path (implies FILE: prefix) while Samba Team fixes the code to allow the access mode prefix for keytabs. On upgrade we need to replace 'dedicated keytab file' value with the path to the Samba keytab that FreeIPA maintains. Since the configuration is stored in the Samba registry, we use net utility to manipulate the configuration: net conf setparm global 'dedicated keytab file' /etc/samba/samba.keytab Fixes https://fedorahosted.org/freeipa/ticket/6551 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Configure Anonymous PKINIT on server installSimo Sorce2016-12-123-1/+111
| | | | | | | | | | | | Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Revert "upgrade: add replica bind DN group check interval to CA topology config"Martin Babinsky2016-12-091-1/+0
| | | | | | | | | This reverts commit 8c6a10ceddb4fce9a3dd4a334e6804800b5c89f9 since it leads to errors in upgrade of first master. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Set explicit confdir option for global contextsChristian Heimes2016-12-022-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | Some API contexts are used to modify global state (e.g. files in /etc and /var). These contexts do not support confdir overrides. Initialize the API with an explicit confdir argument to paths.ETC_IPA. The special contexts are: * backup * cli_installer * installer * ipctl * renew * restore * server * updates The patch also corrects the context of the ipa-httpd-kdcproxy script to 'server'. https://fedorahosted.org/freeipa/ticket/6389 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: add replica bind DN group check interval to CA topology configMartin Babinsky2016-11-291-0/+1
| | | | | | | | | | Without this attribute explicitly set the replication plugin won't recognize updates from members of 'replication managers' sysaccount group, leading to stuck replica CA installation. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-291-1/+2
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move dnssec, p11helper and secrets to ipaserverJan Cholasta2016-11-291-2/+2
| | | | | | | | | | | The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* custodiainstance: automatic restart on config file updateJan Cholasta2016-11-291-1/+1
| | | | | | | | | | | Automatically restart Custodia during IPA server upgrade if custodia.conf was updated. Use the new store class name in custodia.conf.template. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add main guards to a couple of Python scriptsChristian Heimes2016-11-241-1/+2
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: remove incorrect use of MAINTAINERCLEANFILESPetr Spacek2016-11-165-20/+0
| | | | | | | | | | | | | Automake manual section 13 What Gets Cleaned says that make maintainer-clean should not remove files necessary for subsequent runs of ./configure. It practically means that all usage of MAINTAINERCLEANFILES were incorrect so I've removed them. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Moved update of DNA plugin among update pluginsStanislav Laznicka2016-11-111-0/+7
| | | | | | | | | | | | | | | | | To make the code more general, moved the update_dna_shared_config among other update plugins. Bugfix: DNA shared config connection protocol was compared to a method string which would result in a try to always update it even if there was no need to. https://fedorahosted.org/389/ticket/48373 causes that two shared DNA config entries are created instead of one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Build: fix KDC proxy installation and remove unused kdcproxy.confPetr Spacek2016-11-091-1/+4
| | | | | | | | | | The only useful file is /etc/ipa/kdcproxy/kdcproxy.conf so I've removed the other copy of the file in /usr. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: Remove spurious EXTRA_DIST from install/share/Makefile.amPetr Spacek2016-11-091-7/+2
| | | | | | | | | dist_ prefix can be used instead of EXTRA_DIST magic. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: cleanup unused LDIFs from install/sharePetr Spacek2016-11-094-34/+0
| | | | | | | | | | Unused LDIF files were packaged in old tarballs but unused for a long time. Remove them - git log can be used for archaeology if needed. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Purge obsolete firefox extensionTimo Aaltonen2016-10-132-3/+0
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: Support URI resource record typePetr Spacek2016-10-112-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/6344 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused variables in the codeMartin Basti2016-09-271-1/+1
| | | | | | | | | | | This commit removes unused variables or rename variables as "expected to be unused" by using "_" prefix. This covers only cases where fix was easy or only one unused variable was in a module Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* support schema files from third-party pluginsAlexander Bokovoy2016-08-193-0/+31
| | | | | | | | | | | | | Allow upgrade process to include schema files from third-party plugins installed in /usr/share/ipa/schema.d/*.schema. The directory /usr/shar/eipa/schema.d is owned by the server-common subpackage and therefore third-party plugins should depend on freeipa-server-common (ipa-server-common) package in their package dependencies. Resolves: https://fedorahosted.org/freeipa/ticket/5864 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Create indexes for krbCanonicalName attributeMartin Babinsky2016-07-271-0/+9
| | | | | | | | | | | krbCanonicalName is for a long time among the attributes guarded by uniqueness plugins, but there was never an index for it. Now that the attribute is really used to store canonical principal names we need to add index for it to avoid performance regressions. https://fedorahosted.org/freeipa/ticket/6100 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Fix wrong imports in copy-schema-to-ca.pyStanislav Laznicka2016-06-301-3/+13
| | | | | | | | | Some imports were not possible in old versions of IPA. This caused import exceptions on the script start. https://fedorahosted.org/freeipa/ticket/6003 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: cleanup of bininstanceMartin Basti2016-06-282-30/+0
| | | | | | | | | | | | | | | | We don't need anymore: * sample of zone file - list of all records required by IPa will be provided * NTP related params - DNS records will be updated automatically, based on LDAP values * CA related params - DNS records will be updated automatically based * on LDAP values https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* add krbCanonicalName to attributes watched by MODRDN pluginMartin Babinsky2016-06-231-0/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* add case-insensitive matching rule to krbprincipalname indexMartin Babinsky2016-06-231-0/+2
| | | | | | | Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* mark 'ipaKrbPrincipalAlias' attribute as deprecated in schemaMartin Babinsky2016-06-231-1/+1
| | | | | | | part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* DNS: Support default TTL setting for master DNS zonesPetr Spacek2016-06-211-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/2956 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Make sure ipapwd_extop takes precedence over passwd_modify_extopThierry Bordaz2016-06-201-1/+1
| | | | | | | | | | | | DS core server provides a default plugin (passwd_modify_extop) to handle 1.3.6.1.4.1.4203.1.11.1 extended op (https://www.ietf.org/rfc/rfc3062.txt) IPA delivers ipa_pwd_extop plugin that should take precedence over the default DS plugin (passwd_modify_extop) In addition make sure that slapi-nis has a low precedence Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DNS Locations: Rename ipalocationweight to ipaserviceweightMartin Basti2016-06-171-2/+2
| | | | | | | | | Service weight explains better meaning of attribute than location weight, because location itself have no weight only services have. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: dnsserver: use the newer config way in installerMartin Basti2016-06-171-4/+0
| | | | | | | | | Store some parts of DNS configuration in LDAP tree instead of named.conf https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: dnsserver: put server_id option into named.confMartin Basti2016-06-171-0/+1
| | | | | | | | | | The option server_id is required for DNS location feature, otherwise it will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: dnsserver-* commandsMartin Basti2016-06-171-0/+6
| | | | | | | | | | | | | New commands for manipulation with DNS server configuration were added: * dnsserver-show * dnsserver-mod * dnsserver-find https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/PerServerConfigInLDAP https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: dnsservers: add required objectclassesMartin Basti2016-06-171-0/+3
| | | | | | | | | | | | Objectclass: idnsServerConfigObject - stores configuration values for DNS servers Attributetype: idnsServerId - identifier of dns server (server hostname) https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: add idnsTemplateObject objectclassMartin Basti2016-06-171-0/+2
| | | | | | | | | | | The objectclass and its related is used for generating cname records inside bind-dyndb-ldap, see design for more details https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/RecordGenerator https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: add index for ipalocation attributeMartin Basti2016-06-171-0/+9
| | | | | | | | | | For performace ipalocation should be indexed because it is used by referint plugin https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add 'ca' pluginFraser Tweedale2016-06-152-0/+10
| | | | | | | | | | | | | | | | | | | | This commit adds the 'ca' plugin for creating and managing lightweight CAs. The initial implementation supports a single level of sub-CAs underneath the IPA CA. This commit also: - adds the container for FreeIPA CA objects - adds schema for the FreeIPA CA objects - updates ipa-pki-proxy.conf to allow access to the Dogtag lightweight CAs REST API. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-111-1/+2
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Setup lightweight CA key retrieval on install/upgradeFraser Tweedale2016-06-091-0/+6
| | | | | | | | | | | | | | | | | | Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added krb5.conf.d/ to included dirs in krb5.confStanislav Laznicka2016-06-051-0/+1
| | | | | | | | | The include of /etc/krb5.conf.d/ is required for crypto-policies to work properly https://fedorahosted.org/freeipa/ticket/5912 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 11:33:08 +0000